Security and data
Where your data lives, and how it’s kept safe
Plain answers to the questions owners ask us. If something here isn’t clear, email sebboardman00@icloud.com.
Stored in Auckland
Your company’s records and photos are stored in Microsoft Azure’s New Zealand North region, in Auckland. Storage is spread across three separate data centres in the region.
Backed up every night
Your records and photos are backed up every night to separate, write-protected storage in Auckland. Deleted files are recoverable for 30 days.
Walled off from other companies
Many companies use Shedtally, and every request is checked against your company’s own ID. An automated test tries to read one company’s data from another before every release, and the release is blocked if it gets through.
Strong sign-in
Owners and admins use two-factor sign-in with an authenticator app, never text messages. Passwords and PINs are only stored in hashed form.
No tracking
The app doesn’t record where people are. Location details are stripped from photos when they’re uploaded.
Your data is yours
We never sell it, and we never use it to train AI. Owners can export everything at any time, and after you cancel the account stays read-only for 6 months before anything is deleted.
What leaves New Zealand
We’d rather tell you than have you find out. A few services Shedtally relies on run outside NZ:
| Service | What it does | Where |
|---|---|---|
| Microsoft Azure Static Web Apps | Delivers the app’s screens to phones. Holds no customer records. | Microsoft’s global network |
| Azure Communication Services (being set up) | Will send sign-up and alert emails. Not kept after sending. Until then, invites go by link or QR code. | Australia |
| Apple, Google and Mozilla push services | Deliver short notifications to phones. No names or addresses. | United States |
| Xero (if you connect it) | Your accounts, under your own Xero agreement | Xero’s hosting |
| Stripe | Takes subscription payments. We never see full card numbers. | United States / Ireland |
The full list is in our privacy policy.
What we don’t claim
Shedtally isn’t ISO 27001 or SOC 2 certified. We’re a small New Zealand business, and we’d rather say so than imply otherwise. The app helps you keep good records. It doesn’t make your business compliant with any law on its own.
Reporting a security issue
If you think you’ve found a security problem in Shedtally, email sebboardman00@icloud.com. Please include what you found, how to reproduce it, and how to reach you. We’ll acknowledge within 2 working days and keep you updated. Please don’t access, change or delete other people’s data, and give us reasonable time to fix the issue before you tell anyone else. We don’t run a paid bug bounty, but we’re grateful and will credit you if you’d like.
Try it on your own trucks.
6 weeks free. No card. Set it up yourself, invite the crew by link or QR code, and file a real docket today. After the trial your records stay readable and exportable.